Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2024-21690
CVE-2024-21690:
Confluence Server vulnerability analysis and mitigation
Overview
A High severity Reflected XSS and CSRF (Cross-Site Request Forgery) vulnerability (CVE-2024-21690) was discovered in Confluence Data Center and Server. The vulnerability was introduced in multiple versions including 7.19.0, 7.20.0, 8.0.0 through 8.9.0. This security issue was reported through Atlassian's Bug Bounty program and was disclosed on August 20, 2024 (Atlassian Bulletin).
Technical details
The vulnerability has been assigned a CVSS v3.0 score of 7.1 (High) with the vector string CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N. This indicates that the vulnerability can be exploited remotely, requires low attack complexity, needs no privileges, but does require user interaction. The vulnerability allows an unauthenticated attacker to execute arbitrary HTML or JavaScript code on a victim's browser and force an end user to execute unwanted actions on a web application in which they're currently authenticated (ASEC Advisory).
Impact
The vulnerability has a high impact on confidentiality, low impact on integrity, and no impact on availability. It enables attackers to execute arbitrary HTML or JavaScript code in the victim's browser and can force end users to execute unwanted actions in web applications where they are authenticated (Atlassian Bulletin).
Mitigation and workarounds
Atlassian recommends that Confluence Data Center and Server customers upgrade to the latest version. For those unable to do so, specific fixed versions are provided: Confluence Data Center and Server 7.19 should upgrade to version 7.19.26 or higher, version 8.5 should upgrade to 8.5.14 or higher, and version 9.0 should upgrade to 9.0.1 or higher (Atlassian Bulletin).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management